SDSI Practice Test 17 — 15 Questions

Question 1

What is the primary role of a 'Security Policy Engine' (e.g., Cisco Secure Firewall) within an automated data center architecture?

Accepted Answer

Centralized policy enforcement. A Security Policy Engine (such as Cisco Secure Firewall) in an automated data center architecture is responsible for centralized policy enforcement — it applies security rules, intrusion prevention, and access control consistently across the environment. It acts as a policy decision and enforcement point, ensuring that traffic is inspected and allowed or denied based on centrally managed policies.

Answer

Application load balancing

Answer

Server virtualization

Answer

DNS resolution

Question 2

You are designing a secure API gateway architecture using Cisco API Connectivity (part of the Cisco AppDynamics/Cisco Networking stack). To protect against OWASP Top 10 threats, which specific feature should be enabled on the API Gateway to validate request payloads?

Accepted Answer

Configure JSON/XML schema validation policies based on the imported OpenAPI specification.. JSON/XML schema validation policies derived from the imported OpenAPI specification allow the API gateway to reject requests whose payloads do not conform to the contract, which directly mitigates OWASP API threats such as injection, mass assignment, and malformed input. Because the schema is generated from the OpenAPI document, the gateway enforces the exact structure, types, and constraints the API expects, blocking malformed or malicious payloads before they reach the backend. This is the payload-level validation control specifically designed for API security.

Answer

Enable Basic Authentication for all API endpoints.

Answer

Deploy a WAF rule to block all traffic from unknown IP addresses.

Answer

null

Answer

Enable rate limiting on the gateway to prevent DoS attacks.

Question 3

Which THREE Cisco solutions support the 'Secure Work from Anywhere' concept?

Accepted Answer

Cisco Secure Client (AnyConnect).. Cisco Secure Client (AnyConnect) is correct because it provides the endpoint VPN and security agent that lets remote users establish encrypted connectivity to corporate resources from any location. Cisco Duo is correct because its zero-trust, multi-factor authentication and device-trust capabilities verify user and device identity before granting access to applications, which is central to securing a distributed workforce. Cisco Umbrella is correct because its DNS-layer security and secure web gateway protect off-network users from malicious domains and enforce acceptable-use policies regardless of where they connect. Physical desk phone only does not belong because it is a location-bound device that cannot enable secure remote work. Manual VPN configuration files also do not belong because they are a static, error-prone configuration method rather than a managed Cisco solution supporting secure work from anywhere.

Answer

Physical desk phone only.

Answer

Manual VPN configuration files.

Question 4

A security architect is designing an incident response workflow. Which action in the Cisco Secure Endpoint console would be most appropriate to perform if a 'Host Isolation' request fails during an active threat containment?

Accepted Answer

Quarantine the host via Cisco ISE. When Host Isolation in Cisco Secure Endpoint fails, the endpoint remains on the network and the threat is still active, so the architect needs an alternative enforcement point. Cisco ISE can apply a quarantine or remediation authorization profile via 802.1X, MACsec, or TrustSec to restrict the endpoint's network access at the switch or wireless controller. This provides a network-layer containment fallback that does not depend on the endpoint agent's isolation capability.

Answer

Clear the event logs in FMC

Answer

Reboot the Cisco Secure Endpoint server

Answer

Deploy a new firewall policy

Question 5

Which TWO features assist in protecting the network control plane against DoS attacks?

Accepted Answer

Control Plane Policing (CoPP).. Control Plane Policing (CoPP), option D, is correct because it applies a QoS policy to the control plane to rate-limit and filter traffic destined to the router's CPU, protecting routing protocols and management services from DoS floods. Control Plane Protection (CPPr), option E, is correct because it extends CoPP by dividing the control plane into host, transit, and CEF-exception subinterfaces, allowing granular policing of specific traffic types such as ICMP or routing protocol packets. Static routing only (A) does not defend against DoS; it merely removes dynamic routing updates and can even reduce resilience. Increasing interface speed (B) increases bandwidth but does nothing to stop CPU-targeted floods. Disabling all physical interfaces (C) would halt all traffic, including legitimate traffic, so it is not a viable protection mechanism.

Answer

Configuring static routing only.

Answer

Increasing interface speed.

Answer

Disabling all physical interfaces.

Question 6

In a Cisco Secure Firewall architecture, what is the purpose of the 'Intrusion Policy'?

Accepted Answer

To identify and block malicious traffic based on pattern matching.. An Intrusion Policy in Cisco Secure Firewall defines the set of intrusion detection/prevention rules (Snort rules) that inspect traffic for malicious patterns and, when configured in prevention mode, block matching traffic. It is the mechanism that identifies and blocks malicious traffic based on signature/pattern matching. It does not handle routing, VPN authentication, or NAT.

Answer

To optimize routing paths.

Answer

To handle VPN authentication.

Answer

To manage firewall NAT rules.

Question 7

When automating security with Cisco XDR, which component allows for the execution of arbitrary scripts on third-party security tools?

Accepted Answer

Cisco XDR Workflow Engine. The Cisco XDR Workflow Engine allows for the execution of arbitrary scripts and actions on third-party security tools by orchestrating automated response workflows. It connects to integrated tools via APIs and runs playbooks that can invoke scripts, isolate endpoints, block IPs, or create tickets. This is the automation and orchestration layer of Cisco XDR.

Answer

Cisco XDR Threat Intel module

Answer

Cisco XDR Telemetry API

Answer

Cisco XDR Dashboard

Question 8

Which THREE components are part of the Cisco Secure Firewall architecture? (Select 3)

Accepted Answer

Firepower Appliance. The Cisco Secure Firewall architecture is built around three core components: the Firepower Appliance (A), which is the physical or virtual hardware platform that runs the firewall software; the Firepower Management Center (FMC) (C), which provides centralized configuration, policy management, event analysis, and reporting across managed devices; and Firepower Threat Defense (FTD) (D), which is the unified software image combining firewall, IPS, AMP, and URL filtering capabilities on the appliance. These three together form the appliance, the management plane, and the software threat-defense layer of the architecture. Cisco ISE (B) is a separate identity and access-control (NAC/AAA) product, and Cisco Stealthwatch (E) is a separate network traffic analysis and flow-monitoring solution; neither is a component of the Secure Firewall architecture itself.

Answer

Cisco ISE

Answer

Cisco Stealthwatch

Question 9

When designing an automated remediation workflow for Cisco Secure Firewall, what is the specific function of the 'Cisco Secure Firewall REST API' in the context of threat intelligence feeds?

Accepted Answer

Dynamic update of Network Objects. The Cisco Secure Firewall REST API enables programmatic creation, update, and deletion of Network Objects (such as IP addresses, ranges, and FQDN objects) that are used in access control policies. In an automated remediation workflow, threat intelligence feeds can push malicious IPs to these Network Objects via the API, and the firewall policy referencing those objects is updated dynamically without manual intervention. This is the specific function relevant to threat intelligence feed integration.

Answer

Encryption key rotation

Answer

Automated firmware flashing

Answer

Traffic scrubbing

Question 10

When designing security for SaaS applications, what is the primary benefit of an API-based CASB like Cisco Cloudlock over a proxy-based CASB?

Accepted Answer

API-based does not require routing user traffic through the CASB. API-based CASBs like Cisco Cloudlock connect directly to SaaS APIs (e.g., Microsoft 365, Google Workspace, Salesforce) using OAuth, so they can scan data at rest and enforce policies without proxying user traffic. This avoids the latency, certificate, and routing complexity that proxy-based CASBs introduce.

Answer

Proxy-based is cheaper

Answer

API-based only works on-premises

Answer

Proxy-based is always faster

Question 11

In a cloud-native environment, which Cisco solution provides visibility into vulnerabilities within the application code and runtime environment?

Accepted Answer

Cisco Secure Application for AppDynamics. Cisco Secure Application for AppDynamics provides full-stack security observability including code vulnerabilities and runtime threats.

Answer

Cisco Secure Endpoint

Answer

Cisco Stealthwatch

Answer

Cisco Secure Malware Analytics

Question 12

You are designing security for a microservices environment. You want to ensure that if one service is compromised, it cannot easily move laterally to other services. What is the most effective architectural design choice?

Accepted Answer

Implement microsegmentation between services. Microsegmentation between services enforces least-privilege east-west policies so that a compromised service can only communicate with explicitly authorized peers, directly preventing lateral movement. This is the architectural control designed for the stated goal. It works at workload granularity and is the standard Zero Trust answer for limiting blast radius in microservices.

Answer

Keep all services on the same VLAN

Answer

Disable all internal firewalls for better performance

Answer

Use a single shared database for all services

Question 13

In a multi-cloud design, which component is used to connect remote offices directly to the cloud provider while maintaining Cisco-level security?

Accepted Answer

Cisco SD-WAN Cloud OnRamp.. Cisco SD-WAN Cloud OnRamp automates the creation of secure, optimized connectivity from branch offices directly to cloud providers (AWS, Azure, GCP) while applying Cisco's security stack (e.g., Umbrella, SIG, or FTDv) at the branch or cloud edge. It maintains Cisco-level security by integrating with the SD-WAN fabric and policy, unlike a generic IPsec tunnel. This provides direct cloud access without backhauling through a data center.

Answer

Local NAT translation.

Answer

Cisco Secure Access Control Server (ACS).

Answer

Standard site-to-site IPsec tunnel.

Question 14

When designing a remote access VPN solution using Cisco AnyConnect, which protocol is preferred to optimize performance for latency-sensitive applications like VoIP?

Accepted Answer

DTLS. DTLS (Datagram Transport Layer Security) is preferred for Cisco AnyConnect remote access VPN because it operates over UDP, avoiding TCP's head-of-line blocking and retransmission delays that degrade latency-sensitive traffic like VoIP. AnyConnect uses DTLS as the data transport while TLS handles the control channel, providing lower latency and jitter for real-time applications. This makes DTLS the optimal choice for optimizing performance of VoIP over AnyConnect.

Answer

TLS

Answer

IPsec IKEv2

Answer

SSTP

Question 15

Which THREE factors should be considered when designing a security approach for a hybrid work model? (Select 3)

Accepted Answer

Multi-factor authentication (MFA). Option B (Multi-factor authentication, MFA) is correct because in a hybrid work model users authenticate from untrusted home networks and public locations, so adding a second factor beyond passwords mitigates credential theft, phishing, and replay attacks. Option D (Direct internet access security) is correct because remote workers typically bypass the corporate perimeter and connect straight to SaaS and cloud services, so secure web gateways, DNS filtering, CASB, and TLS inspection must protect that direct path. Option E (Endpoint posture assessment) is correct because devices operating outside the managed network must be checked for patch level, disk encryption, EDR health, and compliance before being granted access, often enforced via conditional access or NAC. Option A is not among the selected answers because physical security of a home office, while useful, is not a core technical control for hybrid-work security design, and Option C is not selected because VLAN mapping on home routers is impractical to standardize and is not a recognized enterprise security design factor.

Answer

Physical security of the home office

Answer

VLAN mapping for home routers